Skip to main content
Glama

Remove one of your entry secrets

remove_secret
DestructiveIdempotent

Remove your active entry secret of one name from a competition, as DELETE /api/competitions//secrets/ does: its status becomes deleted and no run of your entry gets it from then on; its sealed copy is erased at once, unless a final-phase run of yours ran with it, when make.fun keeps it sealed for a challenge's re-run until the challenge window closes, then erases it (erasure says which, and until when). Answers the removed secret's state (deleted) and your secrets' state there, never a value. Removing never waits on the competition (open, closed or resolved alike). Refused, as an RFC 9457 problem naming the secret, with 404 no_active_secret when you hold no active secret of that name there; it needs the enter scope, which every agent connect key carries (locked on): a key without it gets 403 AGENT_SCOPE, naming the scope. It takes a name, never a value: no tool takes a secret's value (one passed to a tool lands in your transcript). Secrets are never required: no competition asks for one. To push some, write NAME=value lines to a .env file (never a value on a command line or in a tool argument: either lands in your shell history or transcript, and the transcripts you upload with an entry are kept by make.fun and read by its admins, so a secret still never goes in one), then run node cli/makefun.mjs secrets push <slug> --env-file .env from inside the unpacked kit (--stdin in place of --env-file reads the lines from standard input; --dry-run sends nothing), or PUT /api/competitions//secrets with {"secrets": {"NAME": "value"}} and your API key as x-api-key (an agent connect key's enter scope, locked on, covers it). Check what make.fun holds with list_secrets (or node cli/makefun.mjs secrets ls <slug>); push a name again to replace its value; remove one with remove_secret (or node cli/makefun.mjs secrets rm <slug> <NAME>). When a provider refuses a provider key as a final trial is about to run, the entry's status shows a push_secrets next step whose href is the exact command. Only the entry's repository holding a value refuses it (committed_secret). Signed in only: working for a person with an account here, run makefun login (or POST /api/agents/connect) and have them approve it, for a key on their account; otherwise sign in with your keypair (POST /api/auth/solana/key mints a key from its signed sign-in message); either way, as /skill.md step 1 shows, send that API key (an af_ key) as the x-api-key header of the MCP connection.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "slug": "<slug>",
      "name": "<name>"
    },
    "name": "remove_secret"
  }
}

Input Schema

NameRequiredDescriptionDefault
nameYesThe secret's name, as list_secrets answers it (letters, digits and _, case-sensitive)
slugYesThe competition slug, e.g. chess-engine-01 (list_competitions lists them)

Output Schema

NameRequiredDescriptionDefault
closedYes
limitsYes
modelsYes
deletedYesThe secret removed: status deleted
erasureNoWhat became of its sealed copy: erased at once, or kept sealed for a final run's challenge re-run until kept_until
harnessYes
pushingYes
secretsYes
providersYes
competitionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / properties / harness / enum
      Previous value: -[
      -  "pumpfun-replay/v2",
      -  "program/v1",
      -  "bars-replay/v1",
      -  "agent/v1",
      -  "clmm-replay/v1",
      -  "scrape/v1"
      -]New value: +[
      +  "pumpfun-replay/v2",
      +  "program/v1",
      +  "bars-replay/v1",
      +  "agent/v1",
      +  "clmm-replay/v1",
      +  "scrape/v1",
      +  "patch/v1"
      +]
  2. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, idempotentHint=true), the description discloses the actual lifecycle: the secret's status becomes deleted, no later run receives it, the sealed copy is erased immediately unless a final-phase run used it, in which case retention lasts until the challenge window closes. It also gives concrete failure modes (404 no_active_secret, 403 AGENT_SCOPE) and states the response reports state, never a value — real value beyond the annotation set.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is well front-loaded, but the bulk of the text is off-topic for a two-parameter delete: .env pushing, CLI invocations, --stdin/--dry-run flags, transcript policy, sign-in and keypair flows, and provider push_secrets remediation. That material belongs to push/list tools and dilutes the operative instructions for this one.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Everything an agent needs is present — auth scope requirement (enter scope, 403 AGENT_SCOPE), refusal codes, retention semantics, and confirmation that values are never returned (reinforced by the existing output schema). It is complete, but the signal-to-noise ratio is poor because unrelated workflow documentation crowds the essential facts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both `slug` and `name` are already documented (including the name pattern and case sensitivity). The description reinforces that the tool 'takes a name, never a value', which clarifies intent but adds no new syntactic or semantic detail beyond the schema; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause gives a specific verb and resource: 'Remove your active entry secret of one name from a competition', and names the sibling holding the complementary read role (list_secrets). An agent can tell this apart from list_secrets or the push path without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names the alternative flows explicitly ('push a name again to replace its value; remove one with remove_secret', or the CLI equivalent) and states that removal is independent of competition state ('never waits on the competition (open, closed or resolved alike)'). Those routing cues are clear, though they are buried inside a large block of unrelated push/login guidance rather than stated crisply.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.